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Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
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1 This action is in response to the communication filed on 5/15/2006. 

2 DETAILED ACTION 

3 Response to Arguments 

4 Applicant's arguments filed 5/15/2006 have been fully considered but are moot in view of 

5 new grounds of rejection. 

6 Claims 1-4, 6-12, 14-20, and 22-28 have been examined. Claims 5, 13, and 21 have been 

7 cancelled. 

8 All objections and rejections not presented below have been withdrawn. 

9 Specification 

10 The specification is objected to as failing to provide proper antecedent basis for the 

1 1 claimed subject matter. See 37 CFR 1 .75(d)(1) and MPEP § 608.01(o). Correction of the 

12 following is required: The claim limitations regarding identifying whether (i), (ii) and (iii) in 

13 combination is not supported by the specification. See the rejection of the claims under 35 USC 

14 1 12 1 st Paragraph below. 

1 5 Claim Rejections - 35 USC §112 

1 6 The following is a quotation of the first paragraph of 3 5 U. S.C. 112: 

1 7 The specification shall contain a written description of the invention, and of the manner and process of making 

1 8 and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it 

1 9 pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 

20 contemplated by the inventor of carrying out his invention. 
21 

22 Claims 1-4, 6-12, 14-20, and 22-28 rejected under 35 U.S.C. 1 12, first paragraph, as 

23 failing to comply with the written description requirement. The claim(s) contains subject matter 

24 which was not described in the specification in such a way as to reasonably convey to one skilled 

25 in the relevant art that the inventor(s), at the time the application was filed, had possession of the 
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1 claimed invention. In the instant application, although there is support for each of (i), (ii) and 

2 (iii) in the alternative, as shown in page 7 line 30 - page 8 line 15 of the present specification, 

3 but never as a combination. As such, the ordinary person skilled in the art would not be able to 

4 ascertain whether the applicants had possession of the invention as claimed at the time of 

5 application. Therefore, the claims are rejected for failing to meet the written description 

6 requirement of 35 USC 1 12 1 st Paragraph. 

7 Claim Rejections - 35 USC §103 

8 The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

9 obviousness rejections set forth in this Office action: 

10 (a) A patent may not be obtained though the invention is not identically disclosed or 

1 1 described as set forth in section 102 of this title, if the differences between the subject 

12 matter sought to be patented and the prior art are such that the subject matter as a whole 

1 3 would have been obvious at the time the invention was made to a person having ordinary 

1 4 skill in the art to which said subject matter pertains. Patentability shall not be negatived 

1 5 by the manner in which the invention was made. 
16 

17 Claims 1-3, 7, 9-11, 15, 17-19, and 23 are rejected under 35 U.S.C. 103(a) as being 

1 8 unpatentable over Bates et al. (US Patent Number 6,779,021) hereinafter referred to as Bates, 

19 and further in view of Marsh (US Patent Number 6.763,462). 

20 Regarding claims 1, 9, and 17, Bates disclosed a computer program product operable to 

21 control an e-mail client computer to detect e-mail propagated malware and spam (See Bates Col. 

22 6 Lines 64-67), said computer program product comprising: e-mail generating logic operable to 

23 generate an e-mail message (See Bates Col. 6 Lines 64-67); comparison logic operable to 

24 compare said e-mail message with one or more previously generated e-mail messages from said 

25 client computer (See Bates Col. 9 Lines 3-19); and identifying logic operable to identify 
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1 whether: (i) said e-mail message is being sent to more than a threshold number of addressees 

2 (See Bates Col. 8 Line 56 - Col. 9 Line 2); (ii) said e-mail message contains message content 

3 having at least a threshold level of similarity to message content of said previously generated e- 

4 mail messages being sent to more than a threshold number of addressees (See Bates Col. 9 Line 

5 64 - Col. 10 Line 10); and (iii) said e-mail message contains message content having at least a 

6 threshold level of similarity to message content of more than a threshold number of said 

7 previously generated e-mail messages (See Bates Col. 9 Line 64 - Col. 10 Line 10), wherein said 

8 identifying logic is further operable to identify said email message as potentially containing 

9 spam (including viral spam) if at least one of items (i), (ii), and (iii) is identified (See Bates Fig. 

10 4 A and 4B), and holding said previously generated e-mail messages for at least a predetermined 

1 1 period (See Bates Col. 8 Lines 5-14), but Bates failed to disclose comparing addresses of an 

12 address book, how the "viral spam" was identified, or that the messages were held for a 

13 predetermined period prior to being sent from the client. 

14 Marsh teaches that viruses spread through e-mail by sending messages to addresses found 

15 in address books and that viral activities can be detected when a threshold number of the 

16 addresses of an address book are detected in emails over a certain period of time (See Marsh 

17 Background and Col. 2 Line 34 - Col. 3 Line 65), and further teaches that upon detection of 

1 8 what appears to be viral activity, the user should be given the option to send, save, or delete the 

19 messages (See Marsh Col. 3 Paragraph 3). 

20 It would have been obvious to the ordinary person skilled in the art at the time of 

21 invention to employ the teachings of Marsh in the spam and viral spam detection system of Bates 

22 by detecting viral spam based on thresholds of address book addressees for an email or similar 
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1 emails, and further to provide a user with a warning and the option to delete, save, or send the 

2 detected viral spam messages. This would have been obvious because the ordinary person 

3 skilled in the art would have been motivated to provide means of detecting viral spam as 

4 suggested by Marsh, as well as giving the user the final say in what is to be done with detected 

5 viral spam. Further, in this combination it would be obvious that the messages would be held in 

6 a "quarantine" for a predetermined amount of time prior to sending in order for the user to have 

7 the option of deleting the messages detected as being viral spam without sending the messages. 

8 Regarding claims 2, 10, and 18, the combination of Bates and Marsh disclosed that the e- 

9 mail message specifies a plurality of addressees, said comparison logic being operable to 

10 compare said plurality of addressees with said e-mail address book to determine if said at least a 

1 1 threshold number of addressees has been exceeded (See the rejection of claim 1 above). 

12 Regarding claims 3, 1 1, and 19, the combination of Bates and Marsh disclosed that the at 

13 least a threshold number of addressees is specified as a proportion of addressees within said 

14 address book (See the rejection of claim 1 above). 

15 Regarding claims 7, 15, and 23, the combination of Bates and Marsh disclosed 

16 confirmation input logic operable when said e-mail message is identified as potentially 

17 containing malware to generate a user message seeking a confirmation input from a user of said 

18 client computer before said e-mail message is sent (See the rejection of claim 1 above). 

19 Regarding claim 26, the combination of Bates and Marsh disclosed that said e-mail 

20 message is identified as potentially containing malware (See the rejection of claim 1 above) 

21 when said e-mail message and said previously generated e-mail messages share a common 
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1 attachment (See the rejection of claim 1 above and Bates Col .8 Line 56 - Col. 9 Line 2 wherein 

2 e-mail messages contain attachments [Bates Col. 1 Line 66 - Col. 2 Line 7]). 

3 Claims 4, 6, 12, 14, 20, 22, and 27-28 are rejected under 35 U.S.C. 103(a) as being 

4 unpatentable over the combination of Bates and Marsh as applied to claims 1, 9, and 17 above, 

5 and further in view of Bates et al. (US Patent Number 6,785,732) hereinafter referred to as 

6 Bates2. 

7 Bates and Marsh disclosed both a proportion of addresses (See rejection of claim 3 

8 above) and a specified time period (See rejection of claim 7 above) but failed to disclose the 

9 proportion and the time period could be user specified. 

10 Bates2 teaches that in a virus checker, a users can specify preferences about the virus 

1 1 checking (See Bates2 Col. 8 Lines 49). Bates2 further teaches that when a virus is discovered 

12 the "appropriate authorities" should be notified, including a virus detection company (See Bates2 

13 Col. 8 Paragraph 1). 

14 It would have been obvious to the ordinary person skilled in the art at the time of 

15 invention to employ the teachings of Bates2 in the viral spam detector of Bates and Marsh by 

16 allowing the user to specify the proportion and the time period used for determining a threat. 

17 This would have been obvious because the ordinary person skilled in the art would have been 

1 8 motivated to allow the user of the virus checker to specify how the checker would operate. It 

1 9 further would have been obvious to the ordinary person skilled in the art to forward an infected 

20 email to a virus detection company. This would have been obvious because the ordinary person 

21 skilled in the art would have been motivated to make the company aware of new viruses. 
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1 Claims 8, 16, and 24 are rejected under 35 U. S C. 103(a) as being unpatentable over the 

2 combination of Bates and Marsh as applied to claims 1, 9, and 17 above, and further in view of 

3 Kouznetsov (US Patent Number 6,725,377). 

4 Bates and Marsh disclosed sending alert an alert to a user upon detection of possible virus 

5 activity (See Col. 3 Lines 18-22), but failed to disclose sending an alert to an administrator upon 

6 detection of possible virus activity. 

7 Kouznetsov teaches that in computer intrusion detection systems, when attack 

8 characteristics are detected, it is typical to notify an administrator of the detection (See 

9 Kouznetsov Col. 1 Paragraph 6). 

10 It would have been obvious to the ordinary person skilled in the art at the time of 

1 1 invention to employ the teachings of Kouznetsov in the viral spam detection system of Bates and 

12 Marsh by alerting an administrator of detected possible virus activity. This would have been 

13 obvious because the ordinary person skilled in the art would have been motivated to provide the 

14 administrator with the knowledge of the possible attack in order for the administrator to take 

15 appropriate action. 

16 Claim 25 is rejected under 35 U.S.C. 103(a) as being unpatentable over the combination 

17 of Bates and Marsh as applied to claim 1 above, and further in view of Radatti et al. (US Patent 

1 8 Number 6,763,467) hereinafter referred to as Radatti. 

19 Bates and Marsh disclosed identifying potential malware (See the rejection of claim 1 

20 above) but failed to disclose that only messages including an executable element is identified as 

2 1 potential malware. 
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1 Radatti teaches that only executable code may contain malware (See Radatti Col. 1 Lines 

2 36-48). 

3 It would have been obvious to the ordinary person skilled in the art to employ the 

4 teachings of Radatti in the system of Bates and Marsh by only marking executables as potential 

5 malware. This would have been obvious because the ordinary person skilled in the art would 

6 have been motivated to avoid falsely identifying non-malware as malware. 

7 Conclusion 

8 Claims 1-4, 6-12, 14-20, and 22-28 have been rejected. 

9 Applicant's amendment necessitated the new ground(s) of rejection presented in this 

10 Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 

1 1 Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 .136(a). 

12 A shortened statutory period for reply to this final action is set to expire THREE 



13 MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 

14 MONTHS of the mailing date of this final action and the advisory action is not mailed until after 

15 the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 

16 will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 

17 CFR 1 . 136(a) will be calculated from the mailing date of the advisory action. In no event, 

18 however, will the statutory period for reply expire later than SIX MONTHS from the date of this 

19 final action. 

20 Any inquiry concerning this communication or earlier communications from the 

21 examiner should be directed to Matthew T. Henning whose telephone number is (571) 272-3790. 

22 The examiner can normally be reached on M-F 8-4. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 



2 supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 

3 organization where this application or proceeding is assigned is 571-273-8300. 



5 Application Information Retrieval (PAIR) system. Status information for published applications 

6 may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 

7 applications is available through Private PAIR only. For more information about the PAIR 

8 system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 

9 system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 

10 like assistance from a USPTO Customer Service Representative or access to the automated 

1 1 information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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Information regarding the status of an application may be obtained from the Patent 
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Matthew Henning 
Assistant Examiner 
Art Unit 2131 
7/19/2006 




